Skip to content
hermeticdocs

Known gaps

Read before relying on any of these in production:

  • bws (Bitwarden Secrets Manager CLI) has no confirmed linux-arm64 prebuilt binary; --secrets bitwarden is not fully wired end to end yet.
  • Hermes installs via uv when present on the box, falling back to the venv’s own pip otherwise (packages/agentd/src/apply/index.ts) — implemented, but only exercised against packages/agentd/test/fake-host.ts’s in-memory Host double (no real root, systemd, apt, or network), never a real Ubuntu AMI boot. A real systemd-enabled container suite is future work (§11.5).
  • teardown and foundation update themselves have not run against a real AWS account; those two are still exercised only against aws-sdk-client-mock.
  • No test drives the shipped app bundle end to end. The page’s flow tests run headless over the real RPC bind and dispatch (packages/ui/test/flows/*.flow.test.tsx, with tests/rpc-refusal.test.ts as the seam), which proves the page against the handlers but not the packaged Hermetic.app, its updater, or its window behaviour.
  • No DynamoDB Local tests exist yet (§11.2: conditional-write races, TTL lock expiry, LeadingKeys scoping, and the 500-agent scan latency guard are all specified but untested against a real DynamoDB-shaped store).
  • No end-to-end test in AWS exists yet (§11.7: the full init → create → ready → upgrade → destroy → teardown flow, including a real bootstrap-stage boot, against a dedicated test account).